CVE-2026-122157
Deferred Deferred - Pending Action

Command Injection in Purocean Yank Note

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: VulDB

Description
A vulnerability was identified in Purocean Yank Note 3.93.0. Affected by this vulnerability is the function checkPermission of the file src/main/server/index.ts of the component Terminal Handler. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 3.93.1 addresses this issue. The name of the patch is 59f85d48f17a70a402ad59dcecacdbec20f954df. Upgrading the affected component is recommended.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-122157
EUVD
EUVD-2026-117209

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Purocean Yank Note 3.93.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an unauthenticated remote code execution flaw in Yank Note v3.93.0. It involves an exposed Socket.IO /ws namespace on 127.0.0.1:3044 that mounts a node-pty shell without authentication or Origin validation. Any WebSocket client can connect, send commands, and read output, creating a fully interactive shell running as the logged-in user.

Detection Guidance

Check for an exposed Socket.IO /ws namespace on 127.0.0.1:3044 using tools like netstat or ss. Verify if unauthenticated connections are possible by attempting to connect via WebSocket clients or curl commands to the endpoint.

Impact Analysis

Exploitation enables file theft, credential dumping, and lateral movement within the system. Attackers can execute arbitrary commands with the privileges of the logged-in user, potentially gaining admin access due to loopback permission bypass.

Mitigation Strategies

Upgrade Yank Note to version 3.93.1 or apply the patch 59f85d48f17a70a402ad59dcecacdbec20f954df. Remove node-pty shell exposure and implement token authentication with Origin validation during handshake to prevent unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-122157. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...